IP Intelligence

TRACIO analyzes every visitor's IP address server-side. It flags VPNs, proxies, Tor exit nodes, and datacenter origins, and resolves city-level geolocation. All analysis runs server-side with no client-side dependencies.

Where the data lives

IP intelligence reaches your application through the webhook payload: the network object (VPN/proxy/Tor/datacenter booleans plus connection type) and the geo object (country, city, coordinates, timezone) are delivered on every webhook. ISP and ASN are added on Business and above. See Webhooks for the full payload shape and signature verification.

How it works

VPN, proxy, Tor, and datacenter classification is resolved from the connecting IP using commercial IP intelligence databases (IP2Location for VPN/proxy/Tor type, MaxMind for geolocation and ASN). Each is surfaced as a single boolean on the webhook network object — there is no per-method breakdown or confidence score in the public payload.

{
  "network": {
    "vpn": true,
    "proxy": true,
    "tor": false,
    "datacenter": false,
    "connectionType": "VPN"
  }
}

// `payload` is the webhook delivery body (/docs/webhooks)
if (payload.network.vpn) {
  // visitor is connecting through a VPN
}

Datacenter & Proxy Detection

Datacenter and residential proxies both surface as network.proxy; datacenter origin is additionally reported as network.datacenter. Classification comes from the IP2Location proxy database, which covers major cloud/hosting providers (AWS, Google Cloud, Azure, Oracle Cloud, Alibaba Cloud, DigitalOcean, Hetzner, OVH, Linode/Akamai, Vultr, and others).

{
  "network": {
    "vpn": false,
    "proxy": true,
    "tor": false,
    "datacenter": true,
    "connectionType": "DCH"
  }
}

Tor Detection

A Tor exit-node match on the connecting IP surfaces as network.tor. Separately, the Tor Browser itself is recognized client-side by its anti-fingerprinting configuration, independently of the network path — see Smart Signals.

IP Geolocation

City-level geolocation is resolved server-side from the connecting IP (MaxMind) and delivered on the webhook geo object.

{
  "geo": {
    "country": "CZ",
    "city": "Prague",
    "lat": 50.05,
    "lon": 14.4,
    "timezone": "Europe/Prague"
  }
}

ISP and ASN (Business and above)

On Business and Enterprise plans the carrier is also identified. In the webhook payload both fields live on the network object:

{
  "network": {
    "vpn": false,
    "proxy": false,
    "tor": false,
    "datacenter": false,
    "isp": "Comcast Cable",
    "asn": 7922
  }
}

On a session read from the Server API the split is slightly different: isp sits on geo and asn on network. Same data, two surfaces — read the field from where the surface you are using puts it.

Cross-IP activity (Pro and above)

On Pro and above the webhook carries a velocity block — how much the visitor has been moving around recently:

The block is present when the visitor counters are available at event time (normally the primary phase). A missing block means "no data", not zeros — don't treat its absence as "no unusual activity".

Not exposed

IP-blocklist matching is not part of the public contract: neither the webhook payload nor the dashboard exposes blocklist categories. The webhook surface for network risk is the boolean network flags, the connection type, and the velocity counters above — use those together with the decision and bot fields (see Smart Signals) for risk decisions.

Integration Example

Network-based risk assessment

This reads the webhook payload's network object directly. See Webhooks for the full payload and signature verification.

// `payload` is the webhook delivery body (/docs/webhooks)
function assessIPRisk(payload: WebhookPayload) {
  const { vpn, proxy, tor, datacenter } = payload.network

  const risks: string[] = []
  let riskLevel = "low"

  if (tor) {
    risks.push("Tor exit node")
    riskLevel = "critical"
  }

  if (vpn) {
    risks.push("VPN detected")
    riskLevel = riskLevel === "low" ? "medium" : riskLevel
  }

  if (proxy) {
    risks.push("Proxy detected")
    riskLevel = riskLevel === "low" ? "medium" : riskLevel
  }

  if (datacenter) {
    risks.push("Datacenter IP")
    riskLevel = riskLevel === "low" ? "medium" : riskLevel
  }

  return { riskLevel, risks }
}